Namecheap live chat social engineering leads to loss of 2 VPS • Hacker News Board

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#251

Post by neohaven » Tue, Apr 12, 2016, 5:29 PM UTC

tamar wrote: post #149

pfarnsworth wrote: post #130

Social engineering in tech has been around since before Kevin Mitnick publicized it and went to jail (unjustly). Why do we keep making the same mistakes over and over again as an industry? We NEED UNIFORM security standards with ALL trusted companies with customer support, where we have tiers of support, and 1st tier doesn't have any access that could compromised security. Similar to ISO standards. This means there c…

I hate to break it to you, but "uniform" security standards that are out there in the open would be like a whole can of worms. That is like showing someone "here's a lock and what's inside of it." In time, someone will pick that lock. Uniformity is what you don't need, nor would you want to know the nuances of how security and privacy are handled at a company so that you know exactly what holes need to be exposed. Yo…

"Here's a lock and here's what inside it, but you still can't break it because you lack a separate secret of no mechanical relevance" is the only way to make a system secure. If it is possible at all, you WANT a system where knowledge of all the mechanics do not allow people to crack the safe.

See encryption. A secure crypto mechanism is not vulnerable to disclosure of its mechanism. The key is the secret. The mechanism is not. Having a secret mechanism that relies on its own secrecy means your main weakness is someone explaining how it works to the outside world.

RSA is perfectly well-known. So is rot13. rot13 is crap, disclosure or not. RSA is not as crap, disclosure or not.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#252

Post by fencepost » Tue, Apr 12, 2016, 5:31 PM UTC

snowwolf wrote: post #153

matthewdrussell wrote: post #21

Disclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups

> 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved This is not the correct solution. What's to prevent the next new person from making the same mistake? If it shouldn't happen, don't make it possible to happen. Put in place a technical solution that doesn't allow it happen. And if there is some special case where it still needs to be possible…

This is the kind of 'learning experience' that becomes part of corporate culture and future training. When someone says 'Why bother with all this?' the response can now be 'Read this writeup of how ONE person NOT doing this correctly cost the company a ton of marketing $$$ and STILL left us with a black eye with our more technically-savvy customers.'

And how many people at Namecheap do you think aren't aware of this by now?

But yes, technical solutions should go in but those take longer to implement. Among other things, it seems to me that re-prompting for the account password might be a good idea before any VPS reinstall/reinitialization that's going to wipe an existing VPS (not that it would've helped much here).

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#253

Post by brobinson » Tue, Apr 12, 2016, 5:33 PM UTC

mholt wrote: post #19

tshtf wrote: post #2

The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account. Sometimes you get what you pay for.

> Sometimes you get what you pay for. So what expensive provider do you recommend instead?

Didn't Cloudflare just launch a domain registration service for its high profile clients which can't afford downtime due to a support worker making a mistake like this?

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#254

Post by stordoff » Tue, Apr 12, 2016, 5:33 PM UTC

stephenr wrote: post #87

ToastyMallows wrote: post #10

Earlier quoted context omitted.

It depends on how its implemented. If it's "Whats your mother's maiden name?" and they let you reset it in the browser, it's a bug. But if they send you an email (in my case to Gmail, that has 2FA turned on), then it is a feature, because then you'd be required to either 1) intercept the recovery email (and get the password reset URL) or 2) know the format of the password reset URL and just happen to guess mine after…

I had an interesting thought (literally as I was reading your comment) about improving "forgot password" emails, albeit only likely useful for the technically minded: Have the customer provide an SSH/GPG public key, and store it with the account. When a password reset is requested, encrypt a random string using said public key, and email it to the email for the account. An attacker who may have breached your webmail…

> Have the customer provide an SSH/GPG public key, and store it with the account.

Doesn't this just move the problem from "I forgot my password" to "I lost my private key"?

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#255

Post by alasano » Tue, Apr 12, 2016, 5:33 PM UTC

swanson wrote: post #187

matthewdrussell wrote: post #21

Disclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups

My hobby: role-playing how I would respond as the CEO if my company was getting skewered on HN. Here is my version! --- Disclaimer: I'm [not] CIO @ Namecheap We messed up, big time. While we handle 1000s of live chat sessions everyday without issue, I realize that even one breakdown in security protocol can cause huge problems and a loss of trust for our customers. In response to this isolated case (in which our esta…

I like your response! If only for the fact that I'm seeing people taking apart the real CIOs response like it's code because it's in a numbered list.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#256

Post by rudolf0 » Tue, Apr 12, 2016, 5:34 PM UTC

vehementi wrote: post #225

matthewdrussell wrote: post #21

Disclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups

Putting #1 as #1 looks like bitter deflection. You do it elsewhere in the thread too, saying that lack of 2fa on the email account opened the door to this. You should be well aware both that most security issues end up being perfect storm of circumstances, and that attackers can and will target multiple points in the chain. Relying on #1 as the spearhead of your apparent defense here is tantamount to admitting that y…

It is petty to list it as #1.

However, it's relevant to the story because there's a huge difference between sending a password reset to the email already listed on an account vs. resetting it for any random person who starts a chat.

This doesn't excuse their other issues, but it makes the customer support rep's behavior a bit less awful, even if they still violated protocol.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#257

Post by DasIch » Tue, Apr 12, 2016, 5:35 PM UTC

nrb wrote: post #229

enraged_camel wrote: post #204

Earlier quoted context omitted.

Amazon has the resources to go through intensive identity verification processes. And so do banks. Most tech companies (especially startups) don't.

Doesn't this sound like something a startup can come in and alleviate? Anyone have any recommendations for identity verification as a service?

There are at least two such services in Germany WebID[1] and PostID[1] (not to be confused with the older PostIdent that requires identification at a post office).

I haven't used PostID yet but with WebID you basically have a Skype video call where you show them your ID.

[1]: https://www.webid-solutions.de/en/ [2]: https://www.deutschepost.de/de/p/postid.html

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#258

Post by bostik » Tue, Apr 12, 2016, 5:36 PM UTC

nrb wrote: post #229

enraged_camel wrote: post #204

Earlier quoted context omitted.

Amazon has the resources to go through intensive identity verification processes. And so do banks. Most tech companies (especially startups) don't.

Doesn't this sound like something a startup can come in and alleviate? Anyone have any recommendations for identity verification as a service?

Oh, there's nothing new about that. Startups have identified and entered the space long ago, and the survivors have grown.

So KYC as a service is certainly a thing, and I know of two: Tracesmart & Onfido.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#259

Post by po1nter » Tue, Apr 12, 2016, 5:39 PM UTC

Since the CIO (and another employee) are here. Why are you not offering support for Google Authenticator? Last time someone asked for it was 2 years ago[1] and still no sign of the feature. Cheap prices are good to have but combining that with more security can only add value.

[1]: https://www.namecheap.com/support/knowledgebase/article.aspx...

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#260

Post by mikeash » Tue, Apr 12, 2016, 5:40 PM UTC

oaktowner wrote: post #123

rev_null wrote: post #91

Earlier quoted context omitted.

I once tried to log into a site only to discover that the security question I left for myself was "What is blue?". I never figured it out.

AT&T has a security code which is "What is your favorite restaurant?" that we set a decade ago when signing up for internet service. My wife and I have made, I don't know, 10 guesses over the years and have never been able to figure out what our response was back then. Questions with fact-based answers are much better. But...I once had a site ask me for my best man's first name (Good! This probably won't change over…

I'm always amazed at how little thought seems to go into these questions.

My wife filled one out a few weeks ago where both the questions and answers were selected from popup menus. One of the questions was "What's your favorite summer activity?" Her answer was, "Swimming." Yeah, that's going to add about one bit of entropy to most people's accounts, you idiots.

Another favorite is "middle name of your youngest child." That answer can change over time!